Cryptocurrency exchange Binance suffered a major cyberattack, with preliminary losses estimated at $6.3 billion. About $3 billion in stolen assets were frozen.
Binance, the world’s largest cryptocurrency exchange by trading volume, suffered a major cyberattack overnight on October 30, 2026. According to the company’s preliminary estimates, total losses reached $6.3 billion, making it the largest hack in the history of the crypto industry. The exchange temporarily suspended withdrawals and pledged to fully compensate users for their losses using its Secure Asset Fund for Users (SAFU) and company reserves.
Scale of the Binance Hack
According to data from blockchain analytics firm TRM Labs, attackers drained about $6.36 billion in assets from Binance wallets across 10 blockchain networks. Most of the stolen funds were taken from Ethereum, Bitcoin, and TRON, totaling about $5.89 billion, or more than 92% of the overall losses.
The attackers stole the following assets:
Ethereum: $3.79 billion. The attackers stole 200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD.
Bitcoin: $1.47 billion. A total of 18,270 BTC was withdrawn.
TRON: $628 million. The attackers stole 612.7 million USDT and 46.4 million TRX.
XRP Ledger: $296 million. A total of 233.46 million XRP was withdrawn.
Solana: $96 million. The attackers stole 970,500 SOL.
Arbitrum, Optimism, and Base: $39 million combined. The stolen assets included 74.6 million ARB from Arbitrum.
Avalanche: $28 million. Various tokens were withdrawn, including USDT.
Polygon: $10 million. Various tokens were stolen, including USDT0.
How the Binance Hack May Have Occurred
Binance’s preliminary investigation indicated that a compromised laptop belonging to one of the company’s DevOps engineers may have served as the entry point. Investigators suspect the attackers used the device to gain access to an internal service container and initiate unauthorized transactions. However, the exchange’s security specialists found no evidence that wallet private keys were compromised.
Binance Co-CEO Richard Teng emphasized that the attack was a sophisticated, multistage operation, not a single action carried out using one employee’s access privileges. According to Teng, the investigation hasn’t yet identified a specific individual responsible.
According to TRM Labs, the attackers began preparing at least 36 hours before the theft. Analysts reconstructed the following sequence of events:
Attack Preparation. The hackers established infrastructure for withdrawing assets, funding an operational wallet through small transfers from the Tornado Cash crypto mixer. They then deployed malicious code designed to gain control of a Binance wallet.
Code Testing. The attackers initially tested the code on 2 wallets before testing the final version on a third. After successful testing, the test funds were returned to an address under their control. Four hours later, the same code was deployed to Binance’s Ethereum hot wallet.
Gaining Wallet Control. The attackers used the EIP-7702 mechanism, which allows wallet control to be delegated to a smart contract through a signed authorization. The hackers prepared 50 authorizations in advance, each corresponding to a specific number of previously executed transactions. They submitted all the authorizations in a single transaction, and one proved valid. This allowed them to delegate control of the wallet to a malicious smart contract.
Asset Theft. Just 3 minutes and 24 seconds after gaining control, the attackers withdrew 167,464 ETH and 63 other tokens, including 1.615 billion USDT. Because the delegation remained active, the hackers made 6 additional withdrawals of funds that subsequently arrived in the wallet.
The compromised wallet was also used to execute transactions for another Binance smart account. At the same time, the attackers withdrew assets from Binance wallets on the Bitcoin, TRON, XRP Ledger, Solana, and Optimism networks.
However, TRM Labs analysts couldn’t determine exactly how the attackers obtained the signed EIP-7702 authorizations required to take control of the Ethereum wallet.
Who Is Suspected of Carrying Out the Binance Hack?
Jonathan Levin, Co-Founder and CEO of blockchain analytics firm Chainalysis, linked the Binance hack to the North Korean hacking group TraderTraitor. TRM Labs also expressed high confidence in this assessment, citing on-chain analysis and additional intelligence.
On-chain investigator ZachXBT also identified a connection to a previous attack on Bitget, which resulted in the theft of about $1.5 billion. According to his findings, funds stolen from both exchanges were consolidated at a single address after being transferred through THORChain. The investigator believes the same attacker was likely responsible for both incidents.
The FBI previously attributed the February 2025 Bybit hack to TraderTraitor. However, law enforcement agencies haven’t yet confirmed the group’s involvement in the Binance attack.
Freezing Stolen Funds and Attempts to Move Assets
After detecting the attack, Binance began working with stablecoin issuers, analytics firms, and law enforcement agencies to freeze stolen funds. By October 30, the confirmed value of frozen assets had reached $3 billion.
Several companies and protocols participated in restricting the movement of funds:
Tether and Circle froze more than $1.567 billion in USDT and over $800 million in USDC, respectively;
World Liberty Financial froze $27 million in USD1 stablecoins and $2 million worth of WLFI tokens;
Arbitrum Security Council froze $30.5 million in assets, including 74.6 million ARB and 8,425 ETH;
Ripple began freezing RLUSD stablecoins linked to the attack but didn’t disclose the amount;
First Digital confirmed that it had frozen FDUSD associated with the incident.
Meanwhile, the attackers attempted to convert stolen stablecoins into assets that can’t be centrally frozen. According to TRM Labs, about 325 million USDT was swapped for roughly 122,300 ETH through UniswapX and other services.
The attackers also deposited 60 million USDT as collateral in the Aave lending protocol and borrowed 19,762 WETH worth about $44.6 million. In response, Aave temporarily restricted operations across its V3 and V4 markets. The freeze affected 175 V3 reserves across 16 networks and 117 V4 reserves across 4 networks. Users could still repay loans and withdraw funds, but new deposits and borrowing positions were temporarily suspended.
Crypto Market Reaction and Industry Implications
The cryptocurrency market fell sharply following reports of the hack. According to CoinGecko, BTC declined 4.9%, while ETH lost 5.7% of its value. As of 12:00 (GMT+1) on October 30, BTC was trading at $77,500, while ETH was priced at about $2,200.
Total cryptocurrency market capitalization fell 2.3% over the past 24 hours to about $2.7 trillion. The Crypto Fear & Greed Index dropped to 30, entering the “Fear” zone.
Standard Chartered analysts believe the Binance hack could accelerate the shift of traders from centralized exchanges (CEXs) to decentralized exchanges (DEXs). According to CoinGecko, spot trading volume on the 10 largest DEXs amounted to 23.5% of CEX trading volume in Q2 2026. The figure increased by 2.1 percentage points over the quarter.
When Will Binance Resume Withdrawals?
The cryptocurrency exchange resumed accepting deposits, but withdrawals remain suspended. The company expects to restore withdrawals within 48 hours after completing a security review and upgrading its withdrawal infrastructure.
Binance plans to publish a detailed technical report once investigators establish the full sequence of the attackers’ actions. The final amount of unrecovered losses remains unknown.
